diff --git a/src/main/java/de/ids_mannheim/korap/exceptions/ServiceException.java b/src/main/java/de/ids_mannheim/korap/exceptions/ServiceException.java
new file mode 100644
index 0000000..9e615f3
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/exceptions/ServiceException.java
@@ -0,0 +1,61 @@
+package de.ids_mannheim.korap.exceptions;
+
+import de.ids_mannheim.korap.auditing.AuditRecord;
+import lombok.AccessLevel;
+import lombok.Getter;
+import lombok.Setter;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+/**
+ * @author hanl
+ * @date 08/04/2015
+ */
+// should be a http exception that responds to a service point
+// is the extension of the notauthorized exception!
+@Setter(AccessLevel.PROTECTED)
+@Getter(AccessLevel.PROTECTED)
+public class ServiceException extends Exception {
+
+    protected List<AuditRecord> records = new ArrayList<>();
+    private static final Logger jlog = LoggerFactory
+            .getLogger(ServiceException.class);
+
+    private int status;
+    private String entity;
+    private Object userid;
+
+
+    protected ServiceException (Object userid, Integer status, String message,
+                                String args) {
+        super(message);
+        this.userid = userid;
+        this.status = status;
+        this.entity = args;
+        AuditRecord record = AuditRecord.serviceRecord(userid, status, args);
+        this.records.add(record);
+    }
+
+
+    @Deprecated
+    public ServiceException (Object userid, Integer status, String ... args) {
+        this(userid, status, StatusCodes.getMessage(status), Arrays
+                .asList(args).toString());
+    }
+
+
+    public ServiceException (Integer status, KustvaktException ex) {
+        this(ex.getUserid(), ex.getStatusCode(), ex.getMessage(), ex
+                .getEntity());
+        AuditRecord record = AuditRecord.serviceRecord(ex.getUserid(), status,
+                ex.getEntity());
+        record.setField_1(ex.toString());
+        this.records.add(record);
+        jlog.error("Exception: " + ex.toString());
+    }
+
+}
diff --git a/src/main/java/de/ids_mannheim/korap/web/filter/DemoUserFilter.java b/src/main/java/de/ids_mannheim/korap/web/filter/DemoUserFilter.java
new file mode 100644
index 0000000..1d9f2e6
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/web/filter/DemoUserFilter.java
@@ -0,0 +1,77 @@
+package de.ids_mannheim.korap.web.filter;
+
+import com.sun.jersey.spi.container.ContainerRequest;
+import com.sun.jersey.spi.container.ContainerRequestFilter;
+import com.sun.jersey.spi.container.ContainerResponseFilter;
+import com.sun.jersey.spi.container.ResourceFilter;
+import de.ids_mannheim.korap.config.BeansFactory;
+import de.ids_mannheim.korap.user.TokenContext;
+import de.ids_mannheim.korap.user.User;
+import de.ids_mannheim.korap.utils.TimeUtils;
+import de.ids_mannheim.korap.web.utils.KustvaktContext;
+import de.ids_mannheim.korap.web.utils.KustvaktResponseHandler;
+
+import javax.ws.rs.core.Context;
+import javax.ws.rs.core.UriInfo;
+import javax.ws.rs.ext.Provider;
+import java.security.Principal;
+
+/**
+ * Created by hanl on 7/15/14.
+ */
+@Provider
+public class DemoUserFilter implements ContainerRequestFilter, ResourceFilter {
+
+    @Context
+    UriInfo info;
+
+
+    @Override
+    public ContainerRequest filter (ContainerRequest request) {
+        String host = request.getHeaderValue(ContainerRequest.HOST);
+        String ua = request.getHeaderValue(ContainerRequest.USER_AGENT);
+        String authentication = request
+                .getHeaderValue(ContainerRequest.AUTHORIZATION);
+
+        // means that this is the public service
+        if (authentication == null || authentication.isEmpty()) {
+            Principal pr = null;
+            try {
+                pr = request.getUserPrincipal();
+            }
+            catch (UnsupportedOperationException e) {
+                // do nothing
+            }
+            if (pr == null)
+                request.setSecurityContext(new KustvaktContext(
+                        createShorterToken(host, ua)));
+
+        }
+        return request;
+    }
+
+
+    private TokenContext createShorterToken (String host, String agent) {
+        User demo = User.UserFactory.getDemoUser();
+        TokenContext c = new TokenContext();
+        c.setUsername(demo.getUsername());
+        c.setHostAddress(host);
+        c.setUserAgent(agent);
+        c.setExpirationTime(TimeUtils.plusSeconds(
+                BeansFactory.getKustvaktContext().getConfiguration()
+                        .getShortTokenTTL()).getMillis());
+        return c;
+    }
+
+
+    @Override
+    public ContainerRequestFilter getRequestFilter () {
+        return this;
+    }
+
+
+    @Override
+    public ContainerResponseFilter getResponseFilter () {
+        return null;
+    }
+}
diff --git a/src/main/java/de/ids_mannheim/korap/web/filter/NonDemoBlockingFilter.java b/src/main/java/de/ids_mannheim/korap/web/filter/NonDemoBlockingFilter.java
new file mode 100644
index 0000000..3724fc5
--- /dev/null
+++ b/src/main/java/de/ids_mannheim/korap/web/filter/NonDemoBlockingFilter.java
@@ -0,0 +1,51 @@
+package de.ids_mannheim.korap.web.filter;
+
+import com.sun.jersey.spi.container.ContainerRequest;
+import com.sun.jersey.spi.container.ContainerRequestFilter;
+import com.sun.jersey.spi.container.ContainerResponseFilter;
+import com.sun.jersey.spi.container.ResourceFilter;
+import de.ids_mannheim.korap.user.TokenContext;
+import de.ids_mannheim.korap.web.utils.KustvaktResponseHandler;
+
+import javax.ws.rs.ext.Provider;
+
+/**
+ * @author hanl
+ * @date 11/12/2014
+ *       <p/>
+ *       endpoint filter to block access to an endpoint, in case no
+ *       anonymous access should be allowed!
+ */
+@Provider
+public class NonDemoBlockingFilter implements ContainerRequestFilter,
+        ResourceFilter {
+
+    @Override
+    public ContainerRequest filter (ContainerRequest request) {
+        TokenContext context;
+        try {
+            context = (TokenContext) request.getUserPrincipal();
+        }
+        catch (UnsupportedOperationException e) {
+            throw KustvaktResponseHandler.throwAuthenticationException("");
+        }
+
+        if (context == null || context.isDemo())
+            throw KustvaktResponseHandler
+                    .throwAuthenticationException("Service not available for non-authenticated "
+                            + "or demo account users!");
+        return request;
+    }
+
+
+    @Override
+    public ContainerRequestFilter getRequestFilter () {
+        return this;
+    }
+
+
+    @Override
+    public ContainerResponseFilter getResponseFilter () {
+        return null;
+    }
+}